CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Netbsd : Security Vulnerabilities (Gain Privilege)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-0217 119 Overflow +Priv 2012-06-12 2013-10-10
7.2
None Local Low Not required Complete Complete Complete
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.
2 CVE-2009-2793 264 +Priv 2009-09-18 2009-09-22
4.6
User Local Low Not required Partial Partial Partial
The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment limits.
3 CVE-2008-1215 264 Overflow +Priv 2008-03-08 2008-09-05
4.6
None Local Low Not required Partial Partial Partial
Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters.
4 CVE-2006-6165 +Priv Bypass 2006-11-28 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
** DISPUTED ** ld.so in FreeBSD, NetBSD, and possibly other BSD distributions does not remove certain harmful environment variables, which allows local users to gain privileges by passing certain environment variables to loading processes. NOTE: this issue has been disputed by a third party, stating that it is the responsibility of the application to properly sanitize the environment.
5 CVE-2006-5218 DoS Overflow +Priv 2006-10-10 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
Integer overflow in the systrace_preprepl function (STRIOCREPLACE) in systrace in OpenBSD 3.9 and NetBSD 3 allows local users to cause a denial of service (crash), gain privileges, or read arbitrary kernel memory via large numeric arguments to the systrace ioctl.
6 CVE-2006-0145 +Priv 2006-01-09 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call.
7 CVE-2005-4776 DoS Overflow +Priv 2005-12-31 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; and NetBSD-1.6 before 20050914; allows local users to cause a denial of service (heap corruption or system crash) and possibly gain root privileges.
8 CVE-2005-4741 +Priv 2005-12-31 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without a reset of real credentials.
9 CVE-2004-2012 +Priv 2004-12-31 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.
10 CVE-2004-1374 Exec Code Overflow +Priv 2004-12-18 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges.
11 CVE-2004-0114 +Priv 2004-03-03 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges.
12 CVE-2002-2092 +Priv 2002-12-31 2008-09-05
3.7
User Local High Not required Partial Partial Partial
Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.
13 CVE-2002-1543 Overflow +Priv 2003-03-31 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
Buffer overflow in trek on NetBSD 1.5 through 1.5.3 allows local users to gain privileges via long keyboard input.
14 CVE-2002-1500 Overflow +Priv 2003-04-02 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Buffer overflow in (1) mrinfo, (2) mtrace, and (3) pppd in NetBSD 1.4.x through 1.6 allows local users to gain privileges by executing the programs after filling the file descriptor tables, which produces file descriptors larger than FD_SETSIZE, which are not checked by FD_SET().
15 CVE-2002-1192 Overflow +Priv 2002-10-28 2008-09-10
4.6
User Local Low Not required Partial Partial Partial
Multiple buffer overflows in rogue on NetBSD 1.6 and earlier, FreeBSD 4.6, and possibly other operating systems, allows local users to gain "games" group privileges via malformed entries in a game save file.
16 CVE-2001-1091 +Priv 2001-08-23 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable.
17 CVE-2001-0734 +Priv 2001-10-18 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Hitachi Super-H architecture in NetBSD 1.5 and 1.4.1 allows a local user to gain privileges via modified Status Register contents, which are not properly handled by (1) the sigreturn system call or (2) the process_write_regs kernel routine.
18 CVE-2001-0268 +Priv 2001-05-03 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address.
19 CVE-2001-0053 Overflow +Priv 2001-02-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.
20 CVE-2001-0033 +Priv 2001-02-16 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
KTH Kerberos IV allows local users to change the configuration of a Kerberos server running at an elevated privilege by specifying an alternate directory using with the KRBCONFDIR environmental variable, which allows the user to gain additional privileges.
21 CVE-2000-1208 +Priv 2002-08-12 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper syslog call that uses format strings from the checkremote() call.
22 CVE-2000-0997 +Priv 2000-12-19 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges.
23 CVE-2000-0993 +Priv 2000-12-19 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.
24 CVE-2000-0157 +Priv 2000-02-01 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
NetBSD ptrace call on VAX allows local users to gain privileges by modifying the PSL contents in the debugging process.
25 CVE-2000-0094 +Priv 2000-02-16 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
procfs in BSD systems allows local users to gain root privileges by modifying the /proc/pid/mem interface via a modified file descriptor for stderr.
26 CVE-1999-0434 DoS +Priv 1999-03-30 2008-09-09
7.5
User Remote Low Not required Partial Partial Partial
XFree86 xfs command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service.
27 CVE-1999-0433 DoS +Priv 1999-03-21 2008-09-09
4.6
User Local Low Not required Partial Partial Partial
XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service.
28 CVE-1999-0420 +Priv 1999-03-17 2008-09-09
7.2
Admin Local Low Not required Complete Complete Complete
umapfs allows local users to gain root privileges by changing their uid through a malicious mount_umap program.
Total number of vulnerabilities : 28   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.